Blog for netsec, linux, windows, and hacking! New readers: If you want a list of my posts, check out my "hackive" or "popular posts" on the sidebar! If you want to support my blog there is a donate option, but do not feel obliged as this education is free!

Tuesday, June 28, 2011

I've written most of a how-to and explanation of how to use two programs, SSLStrip and Ettercap, to sniff networks and grab passwords even if a secure connection is used (HTTPS rather than HTTP), but I have to cover a few topics before I release it.
First, I need to explain how to install SSLStrip for those people not using Backtrack 5, then I must explain ARP (Address Resolution Protocol) poisoning and spoofing, since this is an important part of using SSLStrip and Ettercap to grab passwords.

If you're using Backtrack 5, like I mentioned before SSLStrip should be installed already and located in the "/pentest/web/sslstrip" folder and can be run by typing "python sslstrip.py"
For the users not using Backtrack 5, follow the directions below: